WHOIS: Complete Guide to Domain Registration and Ownership Lookup Using Kali Linux

whois is one of the oldest reconnaissance utilities still in active use today. It queries WHOIS databases — centralized registries maintained by domain registrars, Regional Internet Registries (RIRs like ARIN, RIPE, APNIC, LACNIC, and AFRINIC), and IANA — to retrieve registration information about a domain name or an IP address block. This information typically includes the registrant’s organization name, registrar, creation and expiration dates, name servers, and (increasingly rarely, due to GDPR/privacy redaction) administrative and technical contact details.

For a penetration tester or OSINT researcher, whois is almost always the very first command run against a target domain. It is 100% passive — it queries a third-party database, not the target’s own infrastructure — making it one of the safest reconnaissance techniques available.

Installation

whois is pre-installed on Kali Linux. If it is missing (e.g., on a minimal Docker image or a different distribution), it can be installed as follows:

# Debian/Kali/Ubuntu
sudo apt update && sudo apt install whois -y

# RHEL/CentOS/Fedora
sudo yum install whois -y

# macOS (Homebrew)
brew install whois

Verify installation:

whois --version

Syntax

whois [OPTIONS] OBJECT

Where OBJECT is a domain name (e.g., example.com), an IPv4/IPv6 address, or an AS (Autonomous System) number.

Command-Line Options

Basic Usage

whois example.com

Expected output (truncated/abbreviated for readability, actual output has legal disclaimers):

Domain Name: EXAMPLE.COM
Registry Domain ID: 2336799_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.iana.org
Registrar URL: http://res-dom.iana.org
Updated Date: 2024-08-14T07:01:33Z
Creation Date: 1995-08-14T04:00:00Z
Registry Expiry Date: 2025-08-13T04:00:00Z
Registrar: RESERVED-Internet Assigned Numbers Authority
Domain Status: clientDeleteProhibited
Domain Status: clientTransferProhibited
Domain Status: clientUpdateProhibited
Name Server: A.IANA-SERVERS.NET
Name Server: B.IANA-SERVERS.NET
DNSSEC: signedDelegation

Practical Examples

Example 1 — Basic domain lookup

whois hackthebox.com

Domain Name: HACKTHEBOX.COM
Registrar: NameCheap, Inc.
Creation Date: 2017-01-31T10:15:22Z
Name Server: NS1.CLOUDFLARE.COM
Name Server: NS2.CLOUDFLARE.COM

Example 2 — Querying an IP address

whois 8.8.8.8

NetRange: 8.8.8.0 - 8.8.8.255
CIDR: 8.8.8.0/24
OrgName: Google LLC
OrgId: GOGL
Country: US

Example 3 — Querying an ASN

whois AS15169

ASNumber: 15169
ASName: GOOGLE
ASHandle: AS15169
OrgName: Google LLC

Example 4 — Restricting output with -H (hide legal disclaimer)

whois -H tesla.com

Domain Name: TESLA.COM
Registrar: MarkMonitor Inc.
Creation Date: 1992-01-14T05:00:00Z

Example 5 — Querying a specific WHOIS server directly

whois -h whois.arin.net "n 8.8.8.0"

NetRange: 8.8.8.0 - 8.8.8.255
CIDR: 8.8.8.0/24
NetName: LVLT-GOGL-8-8-8

Example 6 — Piping output through grep to extract only name servers

whois github.com | grep -i "Name Server"

Name Server: DNS1.P08.NSONE.NET
Name Server: DNS2.P08.NSONE.NET
Name Server: DNS3.P08.NSONE.NET
Name Server: DNS4.P08.NSONE.NET

Example 7 — Extracting only the registrar and creation date

whois microsoft.com | grep -iE "Registrar:|Creation Date"

Registrar: MarkMonitor Inc.
Creation Date: 1991-05-02T04:00:00Z

Common Use Cases

• Identifying the registrar and registration/expiration dates of a target domain (useful for domain-expiry attacks or social-engineering the registrar).
• Discovering authoritative name servers before running DNS enumeration with dig or dnsrecon.
• Determining IP address block ownership (useful for scoping — confirming an IP belongs to the client and not a shared cloud provider).
• Cross-referencing registrant organization names across multiple domains to discover related infrastructure owned by the same company.
• Gathering historical domain data for phishing-domain or typosquatting investigations.

Automation with Bash

Bulk WHOIS lookups against a list of domains, saving output to individual files:

#!/bin/bash
# bulk_whois.sh - Run whois against a list of domains
INPUT="domains.txt"
OUTDIR="whois_results"
mkdir -p "$OUTDIR"

while IFS= read -r domain; do
    echo "[*] Querying $domain"
    whois "$domain" > "$OUTDIR/${domain}.txt" 2>&1
    sleep 1   # be polite to WHOIS servers / avoid rate limiting
done < "$INPUT"

echo "[+] Done. Results saved in $OUTDIR/"

Extracting registrar names from a directory of saved WHOIS results:

#!/bin/bash
for file in whois_results/*.txt; do
    domain=$(basename "$file" .txt)
    registrar=$(grep -im1 "Registrar:" "$file" | cut -d: -f2- | sed 's/^ *//')
    echo "$domain -> $registrar"
done

Tips and Best Practices

• Always run whois first in an engagement — it is passive, fast, and often reveals name servers that guide the rest of your DNS recon.
• Many gTLDs (.com, .net, .org) now redact registrant personal data due to GDPR; expect to see “REDACTED FOR PRIVACY” for individual registrants, though corporate registrants are usually still visible.
• Use -h to query a specific RIR (ARIN, RIPE, APNIC) directly when you already know which region an IP belongs to — this avoids unnecessary referral hops.
• Rate-limit your queries in automation scripts (sleep 1 or more) — WHOIS servers commonly throttle or temporarily ban IPs that query too aggressively.
• Combine whois output with dig and amass results to build a complete infrastructure map before moving to active scanning.

Troubleshooting

References

• IANA WHOIS Service: https://www.iana.org/domain-names
• ARIN WHOIS/RDAP documentation: https://www.arin.net/resources/registry/whois/
• RIPE Database documentation: https://www.ripe.net/manage-ips-and-asns/db
• Linux man page: man whois
• ICANN RDAP (Registration Data Access Protocol, the modern WHOIS successor): https://www.icann.org/rdap